Multiple buffer overflows in the xfig import code (xfig-import.c) in Dia 0.87 and later before 0.95-pre6 allow user-assisted attackers to have an unknown impact via a crafted xfig file, possibly involving an invalid (1) color index, (2) number of points, or (3) depth.

This update fixes CVE-2006-1550, CVE-2006-2453, CVE-2006-2480

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

'infamous41md' discovered three buffer overflow errors in the xfig import code of dia, a diagram editor, that can lead to the execution of arbitrary code.

An updated Dia package that fixes several buffer overflow bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Dia drawing program is designed to draw various types of diagrams.

infamous41md discovered three buffer overflow bugs in Dia's xfig file format importer. If an attacker is able to trick a Dia user into opening a carefully crafted xfig file, it may be possible to execute arbitrary code as the user running Dia. (CVE-2006-1550)

Users of Dia should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

Secunia reports :

Some vulnerabilities have been reported in Dia, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerabilities are caused due to boundary errors within the XFig import plugin. This can be exploited to cause buffer overflows and may allow arbitrary code execution when a specially crafted FIG file is imported.

The remote host is affected by the vulnerability described in GLSA-200604-14 (Dia: Arbitrary code execution through XFig import)

    infamous41md discovered multiple buffer overflows in Dia's XFig     file import plugin.
  Impact :

    By enticing a user to import a specially crafted XFig file into     Dia, an attacker could exploit this issue to execute arbitrary code     with the rights of the user running Dia.
  Workaround :

    There is no known workaround at this time.

Fixes CVE-2006-1550 Dia multiple buffer overflows

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Three buffer overflows were discovered in the Xfig file format importer. By tricking a user into opening a specially crafted .fig file with dia, an attacker could exploit this to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Three buffer overflows were discovered by infamous41md in dia's xfig import code. This could allow for user-complicit attackers to have an unknown impact via a crafted xfig file, possibly involving an invalid color index, number of points, or depth.

Updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
62280	Fedora Extras 5 : dia-0.95-3	Nessus	Fedora Local Security Checks	high
22567	Debian DSA-1025-1 : dia - programming error	Nessus	Debian Local Security Checks	high
21991	CentOS 4 : dia (CESA-2006:0280)	Nessus	CentOS Local Security Checks	high
21498	FreeBSD : dia -- XFig Import Plugin Buffer Overflow (b5fc63ad-c4c3-11da-9699-00123ffe8333)	Nessus	FreeBSD Local Security Checks	high
21362	RHEL 2.1 / 4 : dia (RHSA-2006:0280)	Nessus	Red Hat Local Security Checks	high
21279	GLSA-200604-14 : Dia: Arbitrary code execution through XFig import	Nessus	Gentoo Local Security Checks	high
21192	Fedora Core 4 : dia-0.94-13.fc4 (2006-261)	Nessus	Fedora Local Security Checks	high
21183	Ubuntu 4.10 / 5.04 / 5.10 : dia vulnerabilities (USN-266-1)	Nessus	Ubuntu Local Security Checks	high
21177	Mandrake Linux Security Advisory : dia (MDKSA-2006:062)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2006-1550

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high